Bilingual

Apple 'Hide My Email' vulnerability reveals peoples' real email addresses
4 days ago
- Apple's Hide My Email service allows iCloud+ users to send and receive emails using random, unique addresses to keep their personal email private.
- Vulnerabilities discovered in Hide My Email enable attackers to uncover the hidden real email addresses behind these aliases.
- The issues were reported to Apple over a year ago, but as of June 30, 2026, they remain unfixed despite Apple claiming fixes on two occasions.
- Researchers realized the vulnerabilities' severity and scope are greater than initially thought, leading to public disclosure to inform users of the risk.
- A timeline details reporting and follow-ups from June 11, 2025, to June 30, 2026, with Apple acknowledging but not effectively resolving the vulnerabilities.
- To protect user privacy, exploit details will not be disclosed until fixes are implemented, but disabling new address creation and notifying users are suggested interim measures.
- The disclosure aims to allow users to account for risks when using Hide My Email and calls for Apple to collaborate openly to resolve the issues promptly.
Apple 'Hide My Email' Vulnerability Reveals Peoples' Real Email Addresses
4 days ago
- Apple's 'Hide My Email' tool has a vulnerability allowing discovery of hidden real email addresses.
- The vulnerability has remained unfixed for over a year, as confirmed by a security researcher and 404 Media's tests.
- Details are withheld because the issue is still exploitable as of the reporting date.
- The article is for paid members, offering unlimited ad-free access and bonus content, with free access available for this specific post.
Guix substitute and guix pull vulnerabilities
21 hours ago
- Guix substitute utility has vulnerabilities enabling remote privilege escalation, store corruption, and file disclosure, affecting all systems regardless of root privileges.
- Exploitation requires downloading a binary substitute; any substitute server or MITM can attack, even with HTTPS, and local exploitation requires socket access.
- Guix pull and guix time-machine have a vulnerability allowing channel file control to create or overwrite files, mainly causing denial-of-service risks.
- Four specific vulnerabilities are detailed: restore-file not hardened, fetch-narinfos not verifying URLs, file:// URI issues, and cache-key misuse.
- Mitigation includes disabling substitutes with --no-substitutes, avoiding untrusted channels files, and updating to fixed commits via guix pull and daemon restart.
- Fixes involve hardening restore-file, verifying narinfos, restricting file:// URIs, and modifying cache-key derivation to prevent directory traversal.
- Upgrading instructions vary for Guix System and other distributions, emphasizing immediate updates and cautious substitute use during the process.
- Timeline shows discovery from May to June 2026, with coordinated disclosure and fixes via pull request #9665.
- A test script is provided to check vulnerability status, with code included for validation.

Hasty Briefsbeta

#vulnerability

Apple 'Hide My Email' vulnerability reveals peoples' real email addresses

Apple 'Hide My Email' Vulnerability Reveals Peoples' Real Email Addresses

Guix substitute and guix pull vulnerabilities